A certificate authority is an organization that verifies who owns a website and issues a digital certificate proving that ownership

When you visit a website with a padlock icon in your browser's address bar, a certificate authority (CA) is what made that padlock appear. The CA checked that the person requesting the certificate actually controls the domain — that they own example.com, not that someone else does — and then issued a signed document saying so. Your browser trusts that document because it trusts the CA that issued it.

Without certificate authorities, there would be no way for your browser to know whether the site claiming to be your bank is actually your bank or a fake one designed to steal your password. The CA is the middleman that makes that verification possible.

Key Takeaways

  • A certificate authority verifies that a website owner controls their domain, then issues a certificate that proves it to your browser.
  • Your browser comes pre-loaded with a list of CAs it trusts; if a CA you don't recognize issued a certificate, your browser will warn you.
  • The certificate includes the domain name, the CA's digital signature, and an expiration date — usually one year from issue.
  • If a CA is compromised or behaves badly, browsers can remove it from their trusted list, making all its certificates invalid overnight.

How a certificate authority verifies domain ownership

When a website owner wants a certificate, they submit a request to a CA along with proof that they control the domain. The CA then performs one of several checks. The most common is an email test: the CA sends a verification link to an email address registered with the domain, and the owner must click it to prove they can receive mail at that domain. Other methods include placing a specific text file on the website itself or updating a DNS record — both things only the domain owner can do.

Once the CA confirms ownership, it creates a certificate containing the domain name, the website owner's public encryption key, the CA's own digital signature, and an expiration date. That signature is the crucial part: it proves the CA has verified the information and stands behind it. Your browser checks that signature using the CA's public key, which is already stored on your computer.

Why your browser trusts certain certificate authorities

Your browser comes with a built-in list of CAs it considers trustworthy. On Windows, this list lives in your system settings. On Mac, it's in the Keychain. On Android and iOS, it's in the operating system itself. These lists include well-known CAs like DigiCert, Let's Encrypt, Sectigo, and GlobalSign — organizations that have been around for years and have proven they follow strict verification procedures.

If a website presents a certificate signed by a CA that is not on your browser's trusted list, you will see a warning. The warning does not mean the website is dangerous — it means your browser cannot verify the certificate's authenticity because it does not recognize the CA that issued it. This can happen with internal corporate networks, where a company runs its own CA, or with very new CAs that browsers have not yet added to their lists.

What happens when a certificate authority makes a mistake or gets hacked

Certificate authorities are high-value targets for attackers because compromising one CA could allow an attacker to create fake certificates for any website. If a CA is hacked or discovered issuing certificates it should not have issued, browsers respond by removing that CA from their trusted list. When that happens, every certificate the CA ever issued becomes invalid, and users see security warnings when trying to visit those websites.

This has happened in the real world. In 2011, a Dutch CA called DigiNotar was compromised, and attackers used it to create fake certificates for Google, Yahoo, and other major sites. Browsers removed DigiNotar from their trusted lists within weeks, and the company went out of business. More recently, in 2023, a smaller CA called TrustCor was removed from Chrome's trusted list after researchers found evidence it was issuing certificates improperly. These incidents show that the system depends on CAs behaving correctly — and on browsers being willing to punish those that do not.

The difference between domain validation and extended validation certificates

Not all certificates require the same level of verification. A domain validation (DV) certificate only confirms that the person requesting it controls the domain — the email test or DNS check described above. This takes minutes and costs very little, which is why Let's Encrypt offers DV certificates for free. DV certificates are perfectly find for encryption; they prove the connection is encrypted, but they do not prove much about who is on the other end.

An extended validation (EV) certificate requires the CA to verify not just domain ownership but also the legal identity of the organization behind the domain. This means checking business registration documents, calling the company's phone number, and confirming the person requesting the certificate has authority to do so. EV certificates take days or weeks and cost more money. In theory, they provide stronger assurance that you are talking to a real, vetted organization — but in practice, most websites use DV certificates, and most users do not notice or care about the difference.

How certificate expiration works and why it matters

Every certificate has an expiration date, usually one year from the date it was issued. When a certificate expires, your browser will show a security warning, even if the certificate was valid the day before. This expiration requirement exists for security: if a private key is ever stolen, the damage is limited to the time until the certificate expires. It also forces website owners to renew their certificates regularly, which gives CAs a chance to re-verify that the owner still controls the domain.

Most website owners use automated renewal systems that request a new certificate 30 days before the old one expires, so the transition is invisible to users. But if renewal fails — because the domain owner forgot to pay, or the verification email went to spam, or the automation broke — the website will suddenly show a security warning to everyone trying to visit it. This is why expiration dates are printed on certificates: they are a built-in safety mechanism, not a bug.

What a self-signed certificate is and when you might see one

A self-signed certificate is one where the website owner has signed the certificate themselves, rather than having a CA sign it. This is technically possible — the encryption works the same way — but your browser will not trust it because the signature comes from someone your browser has never heard of. You might see a self-signed certificate warning when connecting to a company's internal network, a home server, or a development machine.

A self-signed certificate is not inherently dangerous. It still encrypts your connection so that no one on the network can read your traffic. But it does not prove the server is who it claims to be, because anyone can create a self-signed certificate for any domain. For this reason, self-signed certificates are fine for internal use or testing, but not for websites that serve the public.

Frequently Asked Questions

What does it mean when my browser says "certificate not trusted"?

It means the certificate was signed by a CA your browser does not recognize. This can happen if the website uses a self-signed certificate, a very new CA, or a CA that has been removed from your browser's trusted list. It does not necessarily mean the website is malicious — but it does mean you cannot verify the website's identity through normal channels.

Can I trust a website if it has a valid certificate from a CA I have never heard of?

If your browser shows a padlock and does not display a warning, then yes — the CA is on your browser's trusted list, which means it has met the standards set by browser makers. You may not have heard of it, but that does not mean it is untrustworthy. Smaller CAs like Let's Encrypt are trusted by all major browsers.

If a website's certificate expires, is the website hacked?

No. An expired certificate means the website owner did not renew it in time, not that the site has been compromised. The encryption still works, but your browser will warn you because it cannot verify the certificate's authenticity. The owner should renew it when ready.

Do I need to worry about which CA issued a website's certificate?

Not usually. If your browser trusts the CA and shows a padlock, the certificate is valid. The specific CA matters only if you are in a situation where your browser's default trusted list has been modified — for example, at a workplace with its own internal CA.

What happens if I ignore a certificate warning and visit the site anyway?

You can still use the site, and the connection will be encrypted. But you have no way to verify you are talking to the real website and not an impostor. This is risky for sites where you enter passwords or payment information, but low-risk for sites where you are just reading public information.